2d155c74527e9234edd42faf28b2da1f3d5031b3a912e97b681499eb7b42c316

Analysis

max time kernel
97s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 900KB
Sample260629-3cddyahw7s
SHA256 2d155c74527e9234edd42faf28b2da1f3d5031b3a912e97b681499eb7b42c316
MD5 2d72d64be09a2ec4563e9b5827a9da1f
SHA1 f141f36e6fc588b28c0b1dc07391296d82db842c
SHA512 db81f6a3d8096a5e6a38287c017d616f91db5bf980a7acf1f135ce33d5f239a69018d22b858831f0cda9efbb014be7882207331c6949118cf50f9edc3a6ea1ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJC:A3k03kB56rQ
TLSH
T12F157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware aspackv2 discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 49 IoCs

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c536-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2188-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4288-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c93-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018987-185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001898b-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189f8-212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a04-213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a68-233.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019855-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-254.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-267.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a65-268.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-287.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-515.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-643.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-759.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1550.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1571.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1573.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1613.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-2043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-2050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-2185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-2186.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 46 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c536-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b4-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c93-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018987-185.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-198.dat	aspack_v212_v242
behavioral2/files/0x000400000001898b-211.dat	aspack_v212_v242
behavioral2/files/0x00040000000189f8-212.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a04-213.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a68-233.dat	aspack_v212_v242
behavioral2/files/0x0004000000019855-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-254.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-267.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a65-268.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-287.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-515.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-643.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-759.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-860.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1501.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1550.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1571.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1572.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1573.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1576.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1613.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1614.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1615.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1616.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1617.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1709.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1747.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1916.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-2043.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-2050.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-2185.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-2186.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4288	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{AF473AEA-9954-48D4-AA1F-04516D009CBE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{6906BF2F-3EBF-4D0A-AA90-B117546ED3A3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	explorer.exe
1468	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe
Token: SeShutdownPrivilege	1468	explorer.exe
Token: SeCreatePagefilePrivilege	1468	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3048	sihost.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe
1468	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2188	2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4288	patcher.exe
5580	StartMenuExperienceHost.exe
1468	explorer.exe
4140	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1468	3048	sihost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_2d72d64be09a2ec4563e9b5827a9da1f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2188

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1468

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5580

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 900KB
SHA256 2d155c74527e9234edd42faf28b2da1f3d5031b3a912e97b681499eb7b42c316
MD5 2d72d64be09a2ec4563e9b5827a9da1f
SHA1 f141f36e6fc588b28c0b1dc07391296d82db842c
SHA512 db81f6a3d8096a5e6a38287c017d616f91db5bf980a7acf1f135ce33d5f239a69018d22b858831f0cda9efbb014be7882207331c6949118cf50f9edc3a6ea1ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJC:A3k03kB56rQ
TLSH
T12F157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0ffff27458472a9f8718b9985f5bfd3056e290014e2d8238afa60537d7cec939
MD5 c3daa181d5f9e9ddfa0ac84b8227bbe3
SHA1 19d781e6bebb074c9b53041e91a1db8ddbdc83f3
SHA512 3c5e80bd6ae0357f40450e9b31ea683632b02c1386700e5b22b770eada5c88ca2b8b4915e1da290b24a988a71f032f50d652a646e0a769cd2cbaa9279f9d7acf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJC0Le5ji0hmxNrM:A3k03kB56roPji0Aj
TLSH
T16F655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 efaec0a1b0980fae959d77980d75aa854f47107bd55ea75ce3efd27a83221704
MD5 0bd6a5b866ed182fa562367c4b6ed8ed
SHA1 70a8c294c8bae3dca24fceff356f5956778e9824
SHA512 a8678446dadd05d42b29325f84f14dc84831d94df27793882bc2d75b5ae4340cc8290c65e89023bb069802723462bdfcf47f1c7b4cc190febfe6fecd9276b83d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJMa:A3k03kB56r
TLSH
T155157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 948KB
SHA256 4fd18f13ddf04118f646db62f03bf4cc3bab6ce19d76eb2e533f923d1c647e98
MD5 05eabc912dd8868bf0f0301024da5f5a
SHA1 fedfd329b3b95489edfdcb15119d79337a74c82f
SHA512 7e19d9b63dc9fa723dd5c20fb1364a98c6d457b5fc15c85a7a355766087668525fc9f9e609fb45aedadc2701a49034d061e00a31140d676e5febf0ba6b202ec7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJnb:A3k03kB56rxb
TLSH
T161257B03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 924KB
SHA256 56dca4ae9d4560449e86a359f822d8f6c3b5e6027996a99c894ef0f7bfcff7e2
MD5 cb1b3e81ae5ce6f59e471245c62a6661
SHA1 e946b64b02c4a3f05bf237f640b0a20cc59d1fb0
SHA512 ea8a5a409605f7e26f5b6b2b917259b9fde75d8897577739c4456c1302a6e6199a4f2c6bac24e1c7ee6eb7b9e88e6bd912fee6d97e93e89c497193d7a4c1fb70
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJVx:A3k03kB56rV
TLSH
T130157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 924KB
SHA256 2e791acb19330026149b02a70d1574c46443a947292839b088eb5e6d8d008878
MD5 3b81ec98712f0182e1b0ead9e990a4cd
SHA1 c33d5a8e413e0fc671ed486f0fe2e37c64d10fe9
SHA512 66d03fe8fa6a62992dfb4ee1601125b4f6bdc3339bda02917da91e69d31e1c93a08a97aef502656cce6859038ddfc62e8c0f7fed852c307fa0150b4a21dbcc4f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ/s:A3k03kB56re
TLSH
T1CD157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 944KB
SHA256 b28337f48e168f96d2228fce7065eb5d8f5f89652c319dbc25ed117ca70fabef
MD5 dceaa9e86507cefc4e928b975df6d141
SHA1 5e1258f8a09b2324ed698d0f2e25b9f126cf9cdd
SHA512 a7ec76712eaf12031e43333d21df2ee4103b8510da0368991576c3344736d9a9e8362000755102ba148d522840254be6eec75e081225252ec5f7561ebcabfb64
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ9:A3k03kB56rT
TLSH
T1B3257A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 924KB
SHA256 126e8ff60802c8e9bb744399162dbba0a52ba0e6b3da93ccf507240bbe55a2d0
MD5 92d395ed09f638ff74967d6fe71e3bae
SHA1 8c1cc7afffbbc9063a29371cbf4dfdaa292ad211
SHA512 e7ca5582b7dcba34ec02695aa5a37c290448ed68ae95a4fefe5c2e0b91cd1541371d007e9ed32eff2d2080dd45cee4f4cd9e355fca33e8ecc4c1181993378464
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJGZ:A3k03kB56rO
TLSH
T124157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 924KB
SHA256 2072609bd0094fdedb769c93eec8a6456c5f08b974774eb4ab0957d737ad69eb
MD5 785593b89fc9d727af98af0494b40224
SHA1 c84f36afb38c90cbeac933057cb6ac87ad3d9915
SHA512 0924cfd9a2eac4c759a7788b7b1151cb9099a5cecb90df6f834d50eaf36ac5fd340d92b1a3f1a17f219ff74064049b15e97ad7206063ef9ffadcf98d0ee89fbb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJx1:A3k03kB56rJ
TLSH
T17D157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 b567336dbff628522a67e894a9c2a3520575b7b33905788b82b99365ddd7c845
MD5 702b3aead955b122fe0e89544cba12cb
SHA1 0ea28d948112097ef6a3c8ec3e97603de8ff5f50
SHA512 9a057be57db1d555ed9d3013a918a6303ec8a149056748dca219f8c58d91d2d14a92d6bdb67b73fd62884e7cc5f7d696e114bf98c7bc7c4bb2c2150eaf03c5c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJl6:A3k03kB56rW
TLSH
T13B157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 99d17c438e5a864922cc97254fe963bf08bec2cee074e0dce680427b62c94133
MD5 3fc86ad14f8141d863e9082e5915ade9
SHA1 4968edfea34ca5075fccf80103059f078a62dc1a
SHA512 0d522d1c953fa0744b5a46eff2aca0fb6d9a1a05e862a54580da36e4d79c2e21305ad91134759d1a9b9fe671bc808f5901d0b17e3ca3724f603acb19da1a66c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ7N:A3k03kB56rn
TLSH
T17E157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 6b0956cd7843958f7c24ca5b8f5e560e4b95590631e28a7eaba81c0beb67038f
MD5 356fe5bea9dd17f9608e09a04517d679
SHA1 217c783296c870aaf5bf4be54bb1a15f764e8a40
SHA512 fb50855ead52aae5770c886a710cff9e8e6f0c5ece6b873d822b44738e381c06ac3f0d0a908149e7daf46cb2faeb2294a9d3756d128fe3c580ec9e13ffa6fe66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJZf:A3k03kB56rD
TLSH
T164157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 8bba2a3fe3380dd543b275a5fdf92828a6b8d99878cff53f425e741b7c4b5eb6
MD5 78c4c999c53d03859b918d75f0ff2733
SHA1 b8c7ba24ecc49f3a491877a94144ebabfdd40e9a
SHA512 e9b4aac83d1a02b7677ecdaa41ff43e7d0fd7a27131efc26c8bb6228b547f3fa0f8c94ed323e8a3353ae3b2e1c0ba3cbcafda2aefec05096a9c18643f591f06c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJbo:A3k03kB56ry
TLSH
T195157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 eca486d65bd024441ee1cb2bac6cb106658872b6e54d919d50d33db285e8a24a
MD5 9223eaf138d9566ecad33f20f4c0f575
SHA1 8ae46136ea43d8426a623128d1b41ab79a33d0c1
SHA512 016f870e405336b0342be6bfe86e0f3a7c53bbb022cf8941222b7883adc3e156e5f4d163fe4e54fc274dfd111544247ff9cde38cad18209036c8daf918a04348
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJPu:A3k03kB56rc
TLSH
T156157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 fc0af98025d0dd98e609fadc3d4afb1daf1e8b5dd1d1409a67316ea904282934
MD5 ab86ad41cd4364952d120477b0e59335
SHA1 be87bbe2688de1077f3a144f4f336511324cdb4b
SHA512 12691423e1e68f4c83c03eb7993694b8ad6ff15558f23e18653d15f73718bfe3386a278499817ca8a06747553086f2907e587e89167730c57b446e48b5a7101f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJd9:A3k03kB56rB
TLSH
T183157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 4c5085bbff886410de1648ff763e35d81bc86275517018e527edefe0a2a8cec1
MD5 a2d1864d93b4d76dc39c438f4eff5f61
SHA1 e7641c0e0704038d89feddc22b6c728a9163d058
SHA512 e5a4a4e3f91ce6f49d3e110af3da809364727e66e8505ba771cd91c7e1720e814471a676c9b6de64ae134584a09236afadec1d80668e6fe6c3b7200aae6e3ca5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ5c:A3k03kB56rU
TLSH
T11C157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 200fa911c949ed4ae3fe9bc9f178b8d9521c2d948e7dfeb6beaeaa71347671c6
MD5 1bc696d4802da71dbf5c1c3b8be500bd
SHA1 95408227f031269dd2d935bcb86c8f5a03ec584b
SHA512 3ee650466a81cc2f690d33eb4c4a5bc98c7b7df920205cc50aea6485be9d5a34fa304bf34867813e9cabe52d24285cf89a1c2388a3cc8a15fb425ac9d1ed1bf4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJyp:A3k03kB56rC
TLSH
T1F1157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 2feac88bf518bf175ea73a4cdc7afa16a983506a1210734142d0d6ddb3138218
MD5 5556d5f6e041eb0f8fe70ec142921d87
SHA1 2427384e07a1186e69b2178a806a0af718f67b16
SHA512 97456ddfaad50346c49a8149f87c2365bc82e2dd467518c3b6e465a1dd5c5563a6bfa3c1d5803db6de8c8eb170c0e4084113f454b8c3b25420bcf6f096d30d1b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJFN:A3k03kB56rl
TLSH
T15B157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 58ebf7c061c1a97e9408619b02f370c2c7ade8a3f4a62b07c9aab9063e6eac72
MD5 bd79fd5d3d69a9dacddf2b9109f1fbd6
SHA1 2416a03bca22f6cf4d259d44473f5768c9936d91
SHA512 697eaaf380b672e9c0e93c573bf9f414f21cd19bab5a3c6bd577fe445b7479cad44743509047928301d7e7f336a8cb3d643a60b7a405ecfdffdd377aaaf18f3b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJXF:A3k03kB56rv
TLSH
T1A9157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 beaeab62546a506ba2915b66da5c78b1d88408facf085e3e08e684db22249a5a
MD5 1f7ff20907c57dbe1cf3507158392cc5
SHA1 f88a868d402a6e2876dd352637569e8cb67d3cd3
SHA512 dbdea764b6f93a7b7813f220975187be2bac2824f408a5bbecaac6e0a6e6204641b2aeeaa51209d909c90fd8a760cfd3f4f4afda4c471a3ef3be0f4b4c9aaec9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJoC:A3k03kB56rj
TLSH
T17C157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 a3d3eaa9bbf53fff1d7c67f5602c9a948c47a6ca354b22f00a86682b9a4bf93b
MD5 4c85eded73f4573f97ea4874077b0b7a
SHA1 c41c58d03600f9907257e3b2773fc29fcf3542bd
SHA512 0d1d75d4fc8e31efcb42208a09488d09e344da63ba684ac4d49c93585f65772203b835b07a961e450fe4352960ed8df1a362899761b8cd4b17ea6854a7a1f75b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ7w:A3k03kB56rm
TLSH
T176157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 6730e68417c7dffb3e191c098787953d4ad5ee5989454b15984caef4d4ae60b1
MD5 48b29e183d26acffa99aa4589226ad58
SHA1 155cdabb1f5f059ccf0326b2f6fc4bade4ee52f0
SHA512 6ca23da7f3b2c09edce2e8938fd8c9d2ae4fe11d1c52f2af6d9ced55658878b067259d654faf2fe6d9ad0ed984d470f9af862ce512304f94cb7615f313248361
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJCT:A3k03kB56rm
TLSH
T1C1157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 1cde79466619cb7f4765c7a8c088ebec395b0f9eb723278a326a047e5b045976
MD5 aa06f6715e03b16932b3c5cc4263597e
SHA1 03c7d2ccd6aab3bfaf151b76f5e82e9c900d6930
SHA512 3707d9f3bd3950ceaf64f1f5e14b145a1d5f323bf919e387f3cda680d4b453ced0e75551d79b6bbf6b7735a372df8f3d9b56a4e53c6fc16503254ff02ce0568b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJSu:A3k03kB56rB
TLSH
T108157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 6e047705dbc099660af16c55e5b98703975aebd9661d00de959cb2d30e490c15
MD5 b7b038cf63f77cf4d7ee49cd4743f004
SHA1 aff11fd3afc4cdc4d701db9d909fb89b930a7f85
SHA512 389fc89113556e063ae40f05ede601fd5c2f59b41eb0f89e7a50c61ccb63c82acd32dbb33398474a265e45adce1ef59b6fe2cbfe11f73c9ebe9204110d513062
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJMb:A3k03kB56rg
TLSH
T1B5157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 b6a5840e8492c2077d815f1f7cf3e1c7eb165efd8c3dab2a5902285a4f7818be
MD5 aa39b29fb8505b90d212ce84fce44f1c
SHA1 2b303795b7435e4894799ff16c74ec8ff2da8db0
SHA512 3bba55365b95321da6265dd28093862d1f68ad03e246d7625c108a08a46b0e67db50d35debac951983a5284194d17e3736ef6782a21cb2cc2eb2dda700cd99f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJyf:A3k03kB56rQ
TLSH
T15C157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 4ec8ba9aee3ecf10306e64992607fb82296e819cf43a25b927553059d12244ec
MD5 1d0d4df80f8990d6a6745da6ec1b1f22
SHA1 d02e89dc28c3fc106df05c8c795de230919ca7c2
SHA512 75e7389049ec8c52e7cc339cacf1c7521aad22361383fddae4ff2ca25b5edf4b2f4c3c6cbe5d61d5f3bc7b777ccd14ffbe68e0c6eca8f37ebc9980f53b658356
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJfK:A3k03kB56rw
TLSH
T1B5157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 16cabb5eee485c4b884aaa8116a126f6d39c9d01e9d604f57b99ff25631e73d7
MD5 4f877cf45f72f49c2057cee0f92ad1f1
SHA1 f1f62c08580a5e3bfa776e29b21626ca304704b9
SHA512 76331479cfe8ee4a33b28dfde51fcb877324b560966daa63ed1d30beb9d0329af93f0c13fa50126865aed9a02bbd8c0d13bf79609dcf3c29d8c70f721760adcd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ4k:A3k03kB56rZ
TLSH
T14F157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 6e081a92cc0216f52d0bf853c0d2f1e67e3d466c2004316d3310861747a699e0
MD5 d832c0413006a1bbff0ab12ec60f093d
SHA1 31f29298d9e40703204b34046c172482e6fc04ee
SHA512 59544dfcdfd9c056dc9a15be121b8bc5de0b7c4351256ea47402c0eac519c0c515eb28ed62f18569037565713b1261b7e2cdfda7de0780a48aac4292c6c8c3a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ50:A3k03kB56rs
TLSH
T10E157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 c3db8434d03a2f5ce084b566a154cd461e63d07e1ef037a908004fff3e714dc9
MD5 91505763076e1e07507c1d542bad3575
SHA1 b9dd11e2d7ec4de2e2e3800366b19c59e397e81a
SHA512 7522511f53bc2109f5419f92237c4c85ce994906f9ea46c0ffa165ae73cf5d40c472121e2264a0e99bb0cd47c100d8687ea6494f70385e0cddb64bb6b4b99b41
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJsg:A3k03kB56rR
TLSH
T153157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 01a7f7fe440c4332f4b4ba0c11eac76b49580169912b6942425e6692459fad7b
MD5 8296a93b1b2caf8de03febdf922e3b17
SHA1 5d4cd7a048400f35eb14eb44bcfb5ec478922684
SHA512 9f9371dc5d7dfc24be22b561c714f5a9633faef043f5962672cf6fba30d9f1b45b6606cd9217851e84d248eb90b866c93f5fe287aed6df5cb104f068e44897c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJJr:A3k03kB56r7
TLSH
T16D157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 d14ddf801c0b4b0f8122c290bdd47008005fae9fcaef5a9416c7527d20d5653d
MD5 ac195e858c194d0e04977c82ab900b25
SHA1 19c0173f629eff4a107a3e7feb181501c8ebab97
SHA512 73596b6d9f7be4b50c7c8040a11088b975e974e555fb320b26598590d26b9b0f3e2fb6fbc32728ee8542bba09156f317a8a37fc37f5ea83e68d4bd8727bf3444
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJrn:A3k03kB56rN
TLSH
T166157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 26454658e2309b218fef59cd4e8073d152ffbc843a37bc3fd10473112e726f4b
MD5 dec3f6500e1abf675061727cef4aa16f
SHA1 6f3781459cdd1a031d6ed814d3191bf42104f341
SHA512 57a125b52857e8c03df8cd1e505cc58795a517183c0ebe8ae93ec4ea1e8c94a465331b92ccb2bb76749f54504d34b35c30077e43b1f34f44820269cbfe8d2e08
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ3x:A3k03kB56rz
TLSH
T15D157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 05d4e5c3a5561fd82e35886ade9a545e2e5a3b5dbb64026a81afeb9d222c7221
MD5 3ccc3c1d0a5b73f4f147789d97c526c5
SHA1 249fa45e8b72bdffe7906a55c08368665647f145
SHA512 e60ca290fac1700dc68ffd965ca5157f1f9525efd7ac7fa9861f36ebf944367ac5e9976d045b15813b49e9a4ed6b7caec36c4d61566b303d77dff7d3cd1ea188
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJtA:A3k03kB56rM
TLSH
T1BD157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 a980159f931769aa5a1474de37d3517d1895d53d128fd52c5ed5b39dc52f866b
MD5 34409aa296dc0fca8228d552376e25cb
SHA1 3c2d6ea2a4c97e011f63543cddbe50f2c7bb8c48
SHA512 27a48a0125c626fa3a309d33a17e715f10c9aab75a828b7418813bc639a7c2b38af71fb3695442b7ebd06f9adbfaf85904598b52410f4bf609ae556e4a1a315c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJm9Q:A3k03kB56rt
TLSH
T159157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 64128bfb38877ef7de9132e62abc05340793e785dd7318211bc48ce34752d011
MD5 e1fa010a72d16e10e9fa7d65644b889c
SHA1 a038e7f77b63d4fd7b98dc4d374d183824611922
SHA512 382b7416d718820675ae1c3cc21ff7bddf9f721841e5bd24196e6376a460b78093462cd43547d8fbcc8e1265dfe1911f1e1780d0f3c144c1609a60ab5cdb17c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJD4:A3k03kB56ry
TLSH
T191157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 3b86d3090ef2288cddd565a1c27b0841f08ce56118848f493357c80eae676966
MD5 8137fbcf118d6d499cc54bce68b59761
SHA1 99d47f30ec166e91da09a0f62b1f45f4d1d269af
SHA512 172cae9f7892c510482b0f7cd812cdd040e7793c64f8b0215cce72ccfb90626cf34838f98e0554b885161a360816bbb6e2f23bfad019d1089ba9a211b7a6f998
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJqu:A3k03kB56rj
TLSH
T1A7157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 ceee91271c5bfa777df25c21e0b1c5ee1610ae03eb5140e90356b1b0b06013cf
MD5 33e1bb5e3fc202fea56f3080c459af2f
SHA1 da2bca5c01646cbcad7633b9524b0513e7601eb1
SHA512 aeb53e64885e2a05da0da55de109c93a55d8cf3067d311b18a874e7027f48cd1dce742add0fde543c835a84e0d9bd1623cd48ce665e4f0f9d1b018e01e505fb7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ7j:A3k03kB56rN
TLSH
T1DB157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 808f44c191cf8c5190d3a006a04e7711cdcd7bdee7f5132f8b1d859705c6dde4
MD5 21df72f2fe1659a39a2b430c6171995f
SHA1 d391eff6bc1d10501e2d4fc72c08ce35de11dbe0
SHA512 49ab398e8d8e8d9a841d5326db9961017fa41640fed78773bab5d38dcd41fa8809d11645c5cadc392ac1abd74029b35e9f6263f4ee25a8d9566ff52369b0192f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJGg:A3k03kB56rR
TLSH
T160157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 15ec2cd8b1e67a24e457699d41cfe217d8ae344dade40e545fca2395ebd94f08
MD5 d6528a174470d88c465b2d258fc90740
SHA1 0eab8e1ea707378ab834552bae77b28fe5e56038
SHA512 d656ef39cb281ebba2ad57f08c55e7549a722f04d7603752cfb026c190b4c3ee044f4b52ab8cdfce3e86e6a95d35c5602daa9759ead679c2f8c0c9d856fd30bc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJpI:A3k03kB56rA
TLSH
T1EC157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 8f8dae8e87920d9f896fc004d518861be1a961217ec13c3cbbbd6b9b0e57d933
MD5 eb5507c63f114618f26f2b14a4f402ea
SHA1 2bfd5276afd2855c9fc320555cf32b70cf2be68b
SHA512 1847fe9d16fc001ead85d05d8802512dc730b695a7fb9f2bb1a29694d689652da4ed56da64d0c4bb83f7f0a433e1186f587c8f321e9623deaa7e0f1014e7e910
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJLo:A3k03kB56ri
TLSH
T131157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 c8756ae1aaf3eb1c568bb44650336a17a6ce66ea7be0294a8e2202debd95ef5f
MD5 94c82621873a9bf8e11077b4aeae6c80
SHA1 839ae8625d3c93c86486d93aa18ee23a7e2a1025
SHA512 33073cdb2396efff9d262a50f39338ad8d7a0973bd04d00f2d910700d7e6f3577274fc25e9cd08edf871272e90a0508607cf58961fc37dbdee4b2eef0a271531
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJw+:A3k03kB56rH
TLSH
T167157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 35eb91ff3b1d427fc9b08c2d8cd81506ed8799c32bf7c9ba299631420e71e0e1
MD5 4fd98b557e89ae92fa89083a35afeff5
SHA1 125a9f40bcec4eb785768b4902e60f2af3fa9818
SHA512 4bcecb0b735ca21099e44c6e420e15b2e888777afb183e60a71921df57442d40980c42442b7aef4ece57cd427a69cc3e97887d197217b3accb4b7f70a8dc5fe0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJIQ:A3k03kB56rz
TLSH
T1D7157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 a9e94e7bcdc9bfaccda1403b7e0d8c735b6ad6334736918547543f3029226d95
MD5 9297f3745a9f478365f88c8b4946b228
SHA1 58970ce56652dcdd7894be7fb26a47fdfa600b9c
SHA512 82367cf9327400746d88d2efd78ee83e73a0c714c98bd0e392cb0b3769d803599107dd1e4c353ed59854480b3fc80b4dfd4187ce8665bf07851b98458750d32b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJBX:A3k03kB56rn
TLSH
T102157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 a025184743e8f3b3ce802ae4bddd469b3502d5f0e5b60b50a34ff5da1283f69c
MD5 5500ad365ed2502ec466cb6ebdaade0a
SHA1 def27e7f066f329170be97a97b08bcd39c8208c9
SHA512 4f98e7a3ba6ea648e79b19e21048a7656c9855e1e8ad48bc96427a79d64980d593e2209b0bcdc810c08b5aca0d5c858aeb92a8a4e4efd16797ddb8b23a91d6bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJ7L:A3k03kB56rJ
TLSH
T138157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 f63ef1802197f466c2fa9c6fa67a37ad789af75afdda3e51ff039454351d088c
MD5 bfe9eb10551f1ae6afbb7fdbc1d4aed1
SHA1 0cf59ea890826c331fbe650ecff0800b77017f51
SHA512 98cb4663473f84be9c9069252c512bb2b16c2f3951c9c4286c5ea9170e8d79fe34a0512d72709ee39654889a7a5c89460bf81ee82a72a515627d5baa2a341d03
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJBM:A3k03kB56rw
TLSH
T155157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 dbde259ae83bb7bcea1bedca5fe10af9d2de4a877bfbb70838b80073091885aa
MD5 8b5ec95687294dbb145028bae0e00fe7
SHA1 15cab174bb2e08d2c7939e8869810be656042ea8
SHA512 b4eac2da8938b20fad47b172dedcc22c6ffffb75268663573e91f85bd375b0d596f3938e6a54b0c62b719f7250d348611a0147ba44053700c73840c5372b2fc1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjQJqh:A3k03kB56ri
TLSH
T1D9157B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2188-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2188-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4140-1028-0x0000019A83910000-0x0000019A83930000-memory.dmp

Download

memory/4140-1048-0x0000019A83C70000-0x0000019A83C90000-memory.dmp

Download

memory/4140-1029-0x0000019A93E70000-0x0000019A93F70000-memory.dmp

Download

memory/4140-1062-0x0000019A94680000-0x0000019A946A0000-memory.dmp

Download

memory/4140-1018-0x0000019A801E0000-0x0000019A802E0000-memory.dmp

Download

memory/4140-1016-0x0000019A801E0000-0x0000019A802E0000-memory.dmp

Download

memory/4288-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download